<!DOCTYPE html>
  
  
  
  
   <html class="no-js"> 

  <head lang="en-us">
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width,user-scalable=no,initial-scale=1,maximum-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=10" />
    <title>Authorization - Eclipse hawkBit</title>
    <meta name="generator" content="Hugo 0.124.1">

    
    <meta name="description" content="IoT. Update. Device.">
    
    <link rel="canonical" href="https://eclipse.dev/hawkbit/concepts/authorization/">
    
    <meta name="author" content="The Eclipse hawkBit Project">
    

    <meta property="og:url" content="https://eclipse.dev/hawkbit/concepts/authorization/">
    <meta property="og:title" content="Eclipse hawkBit">
    <meta property="og:image" content="https://eclipse.dev/hawkbit/images/hawkbit_icon.png">
    <meta name="apple-mobile-web-app-title" content="Eclipse hawkBit">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">

    

    <link rel="shortcut icon" type="image/x-icon" href="https://eclipse.dev/hawkbit/images/favicon.ico">
    <link rel="icon" type="image/x-icon" href="https://eclipse.dev/hawkbit/images/favicon.ico">

    <style>
      @font-face {
        font-family: 'Icon';
        src: url('https://eclipse.dev/hawkbit/fonts/icon.eot?52m981');
        src: url('https://eclipse.dev/hawkbit/fonts/icon.eot#iefix52m981')
               format('embedded-opentype'),
             url('https://eclipse.dev/hawkbit/fonts/icon.woff?52m981')
               format('woff'),
             url('https://eclipse.dev/hawkbit/fonts/icon.ttf?52m981')
               format('truetype'),
             url('https://eclipse.dev/hawkbit/fonts/icon.svg?52m981#icon')
               format('svg');
        font-weight: normal;
        font-style: normal;
      }
    </style>

    <link rel="stylesheet" href="https://eclipse.dev/hawkbit/stylesheets/application.css">
    <link rel="stylesheet" href="https://eclipse.dev/hawkbit/stylesheets/temporary.css">
    <link rel="stylesheet" href="https://eclipse.dev/hawkbit/stylesheets/palettes.css">
    <link rel="stylesheet" href="https://eclipse.dev/hawkbit/stylesheets/highlight/highlight.css">

    
    
    
    <link rel="stylesheet" href="//fonts.googleapis.com/css?family=Ubuntu:400,700|Ubuntu&#43;Mono">
    <style>
      body, input {
        font-family: 'Ubuntu', Helvetica, Arial, sans-serif;
      }
      pre, code {
        font-family: 'Ubuntu Mono', 'Courier New', 'Courier', monospace;
      }
    </style>

    
    <link rel="stylesheet" href="https://eclipse.dev/hawkbit/css/hawkbit.css">
    
    <link rel="stylesheet" href="//www.eclipse.org/eclipse.org-common/themes/solstice/public/stylesheets/vendor/cookieconsent/cookieconsent.min.css">
    
    <script src="https://eclipse.dev/hawkbit/javascripts/modernizr.js"></script>
    <script src="//www.eclipse.org/eclipse.org-common/themes/solstice/public/javascript/vendor/cookieconsent/default.min.js"></script>

    

    <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.1.0/css/all.css" integrity="sha384-lKuwvrZot6UHsBSfcMvOkWwlCMgc0TaWr+30HWe3a4ltaBwTZhyTEggF5tJv8tbt" crossorigin="anonymous">
  </head>
  <body class="palette-primary-deep-purple palette-accent-light-green">



	
	


<div class="backdrop">
	<div class="backdrop-paper"></div>
</div>

<input class="toggle" type="checkbox" id="toggle-drawer">
<input class="toggle" type="checkbox" id="toggle-search">
<label class="toggle-button overlay" for="toggle-drawer"></label>

<header class="header">
	<nav aria-label="Header">
  <div class="bar default">
    <div class="button button-menu" role="button" aria-label="Menu">
      <label class="toggle-button icon icon-menu" for="toggle-drawer">
        <span></span>
      </label>
    </div>
    <div class="stretch">
      <div class="title">
        Authorization
      </div>
    </div>

    

    
    <div class="button button-github" role="button" aria-label="GitHub">
      <a href="https://github.com/eclipse/hawkbit" title="@eclipse/hawkbit on GitHub" target="_blank" class="toggle-button icon icon-github"></a>
    </div>
    

    
    <div class="button button-github" role="button" aria-label="Gitter">
      <a href="https://gitter.im/eclipse/hawkbit" title="@eclipse/hawkbit on Gitter" target="_blank" class="toggle-button icon fab fa-gitter"></a>
    </div>
    

    
    <div class="button button-github" role="button" aria-label="Docker">
      <a href="https://hub.docker.com/u/hawkbit" title="hawkbit on Docker Hub" target="_blank" class="toggle-button icon fab fa-docker"></a>
    </div>
    
    
        
  </div>
  <div class="bar search">
    <div class="button button-close" role="button" aria-label="Close">
      <label class="toggle-button icon icon-back" for="toggle-search"></label>
    </div>
    <div class="stretch">
      <div class="field">
        <input class="query" type="text" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck>
      </div>
    </div>
    <div class="button button-reset" role="button" aria-label="Search">
      <button class="toggle-button icon icon-close" id="reset-search"></button>
    </div>
  </div>
</nav>
</header>

<main class="main">
	<div class="drawer">
		<nav aria-label="Navigation">
  <a href="https://eclipse.dev/hawkbit/" class="project">
    <div class="banner">
      
        <div class="logo">
          <img src="https://eclipse.dev/hawkbit/images/hawkbit_icon.png">
        </div>
      
      <div class="name">
        <strong>Eclipse hawkBit&trade; </strong>
        
          <br>
          eclipse-hawkbit/hawkbit
        
      </div>
    </div>
  </a>

  <div class="scrollable">
    <div class="wrapper">
      
        <ul class="repo" style="text-align: left; ; padding-left: 2em;">
          <li class="repo-stars">
            <a href="https://github.com/eclipse-hawkbit/hawkbit/stargazers" target="_blank" title="Stargazers" data-action="star">
              <i class="icon icon-star"></i> Stars
              <span class="count">&ndash;</span>
            </a>
          </li>
        </ul>
        <hr>
      

      <div class="toc">
        
        <ul>
          




<li>
  
    



<a  title="What is hawkBit" href="/hawkbit/whatishawkbit/">
	
	What is hawkBit
</a>


  
</li>



<li>
  
    



<a  title="Getting started" href="/hawkbit/gettingstarted/">
	
	Getting started
</a>


  
</li>



<li>
  
    



<a  title="Guides" href="/hawkbit/guides/">
	
	Guides
</a>


  
</li>



<li>
  
    



<a  title="Features" href="/hawkbit/features/">
	
	Features
</a>


  
</li>



<li>
  
    



<a  title="Concepts" href="/hawkbit/concepts/">
	
	Concepts
</a>


  
</li>



<li>
  
    



<a  title="Architecture" href="/hawkbit/architecture/">
	
	Architecture
</a>


  
</li>



<li>
  
    



<a  title="APIs" href="/hawkbit/apis/">
	
	APIs
</a>


  
</li>



<li>
  
    



<a  title="Release notes" href="/hawkbit/release-notes/">
	
	Release notes
</a>


  
</li>



<li>
  
    



<a  title="Blog" href="/hawkbit/blog/">
	
	Blog
</a>


  
</li>



<li>
  
    



<a  title="Community" href="/hawkbit/community/">
	
	Community
</a>


  
</li>


        </ul>
        

        
        <hr>

        <ul>
          <li>
            <a href="https://opensource.org/licenses/EPL-2.0" title="License" target="_blank">
              <img src="https://img.shields.io/badge/License-EPL%202.0-green.svg" />
            </a>
          </li>

          <li>
            <a href="https://github.com/eclipse-hawkbit/hawkbit/actions/workflows/verify.yml" title="License" target="_blank">
              <img src="https://github.com/eclipse-hawkbit/hawkbit/actions/workflows/verify.yml/badge.svg?branch=master" />
            </a>
          </li>
          <li>
            <a href="https://sonarcloud.io/summary/new_code?id=eclipse-hawkbit_hawkbit" title="Sonarcloud Status" target="_blank">
              <img src="https://sonarcloud.io/api/project_badges/measure?project=eclipse-hawkbit_hawkbit&metric=alert_status" />
            </a>
          </li>

          <li>
            <a href="https://search.maven.org/search?q=g:org.eclipse.hawkbit" title="Maven Central Status" target="_blank">
              <img src="https://img.shields.io/maven-central/v/org.eclipse.hawkbit/hawkbit-parent?label=maven-central&color=blue" />
            </a>
          </li>

          <li>
            <a href="https://gitter.im/eclipse/hawkbit?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge" title="Chat on Gitter" target="_blank">
              <img src="https://badges.gitter.im/eclipse/hawkbit.svg" />
            </a>
          </li>
        </ul>
        
      </div>
    </div>
  </div>
</nav>

	</div>

	<article class="article">
		<div class="wrapper">
			<h1>Authorization </h1>

			<p>Authorization is handled separately for <em>Direct Device Integration (DDI) API</em> and <em>Device Management Federation (DMF)
API</em> (where successful authentication includes full authorization) and <em>Management API</em> and <em>UI</em> which is based on
Spring
security <a href="https://github.com/eclipse-hawkbit/hawkbit/blob/master/hawkbit-security-core/src/main/java/org/eclipse/hawkbit/im/authentication/SpPermission.java">authorities</a>.</p>
<p>However, keep in mind that hawkBit does not offer an off the shelf authentication provider to leverage these permissions
and the underlying multi user/tenant capabilities of hawkBit but it supports authentication providers offering an OpenID
Connect interface. Check out <a href="http://projects.spring.io/spring-security/">Spring security documentation</a> for further
information. In
hawkBit <a href="https://github.com/eclipse-hawkbit/hawkbit/blob/master/hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/SecurityAutoConfiguration.java">SecurityAutoConfiguration</a>
is a good starting point for integration.</p>
<p>The default implementation is single user/tenant with basic auth and the logged in user is provided with all
permissions. Additionally, the application properties may be configured for multiple static users;
see <a href="#multiple-users">Multiple Users</a> for details.</p>
<h2 id="ddi-api">DDI API</h2>
<p>An authenticated target is permitted to:</p>
<ul>
<li>retrieve commands from the server</li>
<li>provide feedback to the the server</li>
<li>download artifacts that are assigned to it</li>
</ul>
<p>A target might be permitted to download artifacts without authentication (if enabled, see above). Only the download can
be permitted to disable the authentication. This can be used in scenarios where the artifacts itself are e.g. signed and
secured.</p>
<h2 id="management-api-and-ui">Management API and UI</h2>
<h3 id="multiple-users">Multiple Users</h3>
<p>hawkBit optionally supports configuring multiple static users through the application properties. In this case, the user
and password Spring security properties are ignored.
An example configuration is given below.</p>
<pre><code>hawkbit.server.im.users[0].username=admin
hawkbit.server.im.users[0].password={noop}admin
hawkbit.server.im.users[0].firstname=Test
hawkbit.server.im.users[0].lastname=Admin
hawkbit.server.im.users[0].email=admin@test.de
hawkbit.server.im.users[0].permissions=ALL

hawkbit.server.im.users[1].username=test
hawkbit.server.im.users[1].password={noop}test
hawkbit.server.im.users[1].firstname=Test
hawkbit.server.im.users[1].lastname=Tester
hawkbit.server.im.users[1].email=test@tester.com
hawkbit.server.im.users[1].permissions=READ_TARGET,UPDATE_TARGET,CREATE_TARGET,DELETE_TARGET
</code></pre>
<p>A permissions value of <code>ALL</code> will provide that user with all possible permissions. Passwords need to be specified with
the used password encoder in brackets. In this example, <code>noop</code> is used as the plaintext encoder. For production use, it
is recommended to use a hash function designed for passwords such as <em>bcrypt</em>. See
this <a href="https://spring.io/blog/2017/11/01/spring-security-5-0-0-rc1-released#password-storage-format">blog post</a> for more
information on password encoders in Spring Security.</p>
<h3 id="openid-connect">OpenID Connect</h3>
<p>hawkbit supports authentication providers which use the OpenID Connect standard, an authentication layer built on top of
the OAuth 2.0 protocol.
An example configuration is given below.</p>
<pre><code>spring.security.oauth2.client.registration.oidc.client-id=clientID
spring.security.oauth2.client.provider.oidc.issuer-uri=https://oidc-provider/issuer-uri
spring.security.oauth2.client.provider.oidc.jwk-set-uri=https://oidc-provider/jwk-set-uri
</code></pre>
<p>Note: at the moment only DEFAULT tenant is supported. By default the resource_access/<client id>/roles claim is mapped
to hawkBit permissions.</p>
<h3 id="delivered-permissions">Delivered Permissions</h3>
<ul>
<li>
<p>READ_/UPDATE_/CREATE_/DELETE_TARGET for:</p>
<ul>
<li>Target entities including metadata (that includes also the installed and assigned distribution sets)</li>
<li>Target tags</li>
<li>Target actions</li>
<li>Target registration rules</li>
<li>Bulk operations</li>
<li>Target filters</li>
</ul>
</li>
<li>
<p>READ_/UPDATE_/CREATE_/DELETE_REPOSITORY for:</p>
<ul>
<li>Distribution sets</li>
<li>Software Modules</li>
<li>Artifacts</li>
<li>DS tags</li>
</ul>
</li>
<li>
<p>READ_TARGET_SECURITY_TOKEN</p>
<ul>
<li>Permission to read the target security token. The security token is security concerned and should be protected.</li>
</ul>
</li>
<li>
<p>DOWNLOAD_REPOSITORY_ARTIFACT</p>
<ul>
<li>Permission to download artifacts of a software module (Note: READ_REPOSITORY allows only to read the metadata).</li>
</ul>
</li>
<li>
<p>TENANT_CONFIGURATION</p>
<ul>
<li>Permission to administrate the tenant settings.</li>
</ul>
</li>
<li>
<p>READ_/UPDATE_/CREATE_/DELETE_/HANDLE_/APPROVE_ROLLOUT for:</p>
<ul>
<li>Managing rollouts and provision targets through a rollout.</li>
</ul>
</li>
</ul>
<h3 id="permission-matrix-for-example-uses-cases-that-need-more-than-one-permission">Permission Matrix for example uses cases that need more than one permission</h3>
<table>
<thead>
<tr>
<th>Use Case</th>
<th>Needed permissions</th>
</tr>
</thead>
<tbody>
<tr>
<td>Search <em>targets</em> by installed or assigned <em>distribution set</em></td>
<td>READ_REPOSITORY, READ_TARGET</td>
</tr>
<tr>
<td>Assign <em>DS</em> to a <em>target</em></td>
<td>READ_REPOSITORY, UPDATE_TARGET</td>
</tr>
<tr>
<td>Assign DS to target through a <em>Rollout</em>, i.e. <em>Rollout</em> creation and start</td>
<td>READ_REPOSITORY, READ_TARGET, READ_ROLLOUT, CREATE_ROLLOUT, HANDLE_ROLLOUT</td>
</tr>
<tr>
<td>Read <em>Rollout</em> status including its <em>deployment groups</em></td>
<td>READ_REPOSITORY, READ_ROLLOUT</td>
</tr>
<tr>
<td>Checks <em>targets</em> inside <em>Rollout deployment group</em></td>
<td>READ_REPOSITORY, READ_TARGET, READ_ROLLOUT</td>
</tr>
</tbody>
</table>
<h2 id="device-management-federation-api">Device Management Federation API</h2>
<p>The provided <em>RabbitMQ</em> <a href="https://www.rabbitmq.com/access-control.html">vhost and user</a> should be provided with the
necessary permissions to send messages to hawkBit through the exchange and receive messages from it through the
specified queue.</p>

			<aside class="copyright" role="note">
  <div class="logo">
    <a href="https://www.eclipse.org" target="_blank">
      <img src="/hawkbit/images/eclipse_foundation_logo.png" />
    </a>
  </div>
  <p class="notice">
    
    &copy; 2025 The Eclipse hawkBit Project &ndash;
    
    Documentation built with
    <a href="https://www.gohugo.io" target="_blank">Hugo</a>
    using the
    <a href="http://github.com/digitalcraftsman/hugo-material-docs" target="_blank">Material</a> theme.
  </p>
  <p class="quickLinks">
    <a href="http://www.eclipse.org/legal/privacy.php" target="_blank">
      &gt; Privacy Policy
    </a>
    <a href="http://www.eclipse.org/legal/termsofuse.php" target="_blank">
      &gt; Terms of Use
    </a>
    <a href="http://www.eclipse.org/legal/copyright.php" target="_blank">
      &gt; Copyright Agent
    </a>
    <a href="http://www.eclipse.org/legal" target="_blank">
      &gt; Legal
    </a>
    <a href="https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.txt" target="_blank">
      &gt; License
    </a>
  </p>
</aside>


			<footer class="footer">
				

<nav class="pagination" aria-label="Footer">
  <div class="previous">
  
      <a href="https://eclipse.dev/hawkbit/concepts/datamodel/" title="Data Model">
        <span class="direction">
          Previous
        </span>
        <div class="page">
          <div class="button button-previous" role="button" aria-label="Previous">
            <i class="icon icon-back"></i>
          </div>
          <div class="stretch">
            <div class="title">
              Data Model
            </div>
          </div>
        </div>
      </a>
  
  </div>

  <div class="next">
  
      <a href="https://eclipse.dev/hawkbit/concepts/authentication/" title="Authentication">
        <span class="direction">
          Next
        </span>
        <div class="page">
          <div class="stretch">
            <div class="title">
              Authentication
            </div>
          </div>
          <div class="button button-next" role="button" aria-label="Next">
            <i class="icon icon-forward"></i>
          </div>
        </div>
      </a>
  
  </div>
</nav>





			</footer>
		</div>
	</article>

	<div class="results" role="status" aria-live="polite">
		<div class="scrollable">
			<div class="wrapper">
				<div class="meta"></div>
				<div class="list"></div>
			</div>
		</div>
	</div>
</main>

    <script>
    
      var base_url = 'https:\/\/eclipse.dev\/hawkbit\/';
      var repo_id  = 'eclipse-hawkbit\/hawkbit';
    
    </script>

    <script src="https://eclipse.dev/hawkbit/javascripts/application.js"></script>
    

    <script>
      /* Add headers to scrollspy */
      var headers   = document.getElementsByTagName("h2");
      var scrollspy = document.getElementById('scrollspy');

      if(scrollspy) {
          if(headers.length > 0) {
              for(var i = 0; i < headers.length; i++) {
                  var li = document.createElement("li");
                  li.setAttribute("class", "anchor");

                  var a  = document.createElement("a");
                  if(!headers[i].id)
                      a.setAttribute("href", headers[i].parentNode.href);
                  else
                      a.setAttribute("href", "#" + headers[i].id);
                  a.setAttribute("title", headers[i].innerHTML);
                  a.innerHTML = headers[i].innerHTML;

                  li.appendChild(a);
                  scrollspy.appendChild(li);
              }
          } else {
              scrollspy.parentElement.removeChild(scrollspy)
          }


        /* Add permanent link next to the headers */
          var headers = document.querySelectorAll("h1, h2, h3, h4, h5, h6");

        for(var i = 0; i < headers.length; i++) {
            var a = document.createElement("a");
            a.setAttribute("class", "headerlink");
            a.setAttribute("href", "#" + headers[i].id);
            a.setAttribute("title", "Permanent link");
            a.innerHTML = "#";
            headers[i].appendChild(a);
        }
      }
    </script>

    <script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.8.0/highlight.min.js"></script>
    <script>hljs.initHighlightingOnLoad();</script>
  </body>
</html>

